21–30 of 79 posts
Is there any legitimate reason to discriminate because of age?
This kid just blamed Paypal for one of our country's many idiotic federal laws.
This choice should be considered a career limiting decision by any hiring manager.
The downside of Child Labor laws.
The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.
Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company.
This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.
Is there any legitimate reason to discriminate because of age?
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
Earlier quoted context omitted.
I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.
There's a CSRF token in the form, but deleting it doesn't seem to cause the search to fail.
It seems quite possible that CSRF checks could have been omitted in not expecting this to be a source of woe. Just goes to show... :P
Is there any legitimate reason to discriminate because of age?
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
2. well, fuck paypal!
3. not a good way to show PoC. Is there antiCSRF on search form? Can I see the whole flow?
Earlier quoted context omitted.
It doesn't matter that the form is POST only if it doesn't do CSRF checks. (I haven't checked.)
That is not what I am disputing. If there is a bug in paypal's search via POST only, you cannot link to paypal's search. You would need to link to a page you control that performs the POST automatically. If you send a link to the search that only takes parameters via POST, paypal will never receive the payload.
Note that _if_ the form is already CSRF-protected, then attackers won't easily be able to POST from a different domain either, which would drastically reduce the attack surface.
I didn't test this, but I'm not sure the form is fully CSRF protected though. I tried to explain the potential exploit from this discovered vulnerability. Perhaps I should have stated more clearly that this is more a general comment, and not specific to this particular case.
Earlier quoted context omitted.
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
Couldn't they just pay him once he turns 18? Or at the least reward him in some other way.
Earlier quoted context omitted.
As an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for exam…
> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users. Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.
The next person who'll discover something, will probably monetize it on the black market.